PPAPI: Really force-free NPObjects on Instance destruction.

webkit/plugins/ppapi/ppapi_webplugin_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/ppapi_webplugin_impl.h"
 
 #include <cmath>
 
 #include "base/message_loop.h"
 #include "googleurl/src/gurl.h"
-#include "ppapi/c/pp_var.h"
+#include "ppapi/shared_impl/ppapi_globals.h"
+#include "ppapi/shared_impl/var_tracker.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebBindings.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebDocument.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebElement.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFrame.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPluginContainer.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPluginParams.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebPoint.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebRect.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebView.h"
 #include "webkit/plugins/ppapi/message_channel.h"
@@ skipping 22 matching lines @@
   std::vector<std::string> arg_names;
   std::vector<std::string> arg_values;
   GURL url;
 };
 
 WebPluginImpl::WebPluginImpl(
     PluginModule* plugin_module,
     const WebPluginParams& params,
     const base::WeakPtr<PluginDelegate>& plugin_delegate)
     : init_data_(new InitData()),
-      full_frame_(params.loadManually) {
+      full_frame_(params.loadManually),
+      instance_object_(PP_MakeUndefined()) {
   DCHECK(plugin_module);
   init_data_->module = plugin_module;
   init_data_->delegate = plugin_delegate;
   for (size_t i = 0; i < params.attributeNames.size(); ++i) {
     init_data_->arg_names.push_back(params.attributeNames[i].utf8());
     init_data_->arg_values.push_back(params.attributeValues[i].utf8());
   }
   init_data_->url = params.url;
 }
 
@@ skipping 19 matching lines @@
     instance_ = NULL;
     return false;
   }
 
   init_data_.reset();
   return true;
 }
 
 void WebPluginImpl::destroy() {
   if (instance_) {
+    ::ppapi::PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(instance_object_);
+    instance_object_ = PP_MakeUndefined();
     instance_->Delete();
     instance_ = NULL;
   }
 
   MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }
 
 NPObject* WebPluginImpl::scriptableObject() {
-  // Call through the plugin to get its instance object. Note that we "leak" a
-  // reference here. But we want to keep the instance object alive so long as
-  // the instance is alive, so it's okay. It will get cleaned up when all
-  // NPObjectVars are "force freed" at instance shutdown.
-  scoped_refptr<NPObjectVar> object(
-      NPObjectVar::FromPPVar(instance_->GetInstanceObject()));
+  // Call through the plugin to get its instance object. The plugin should pass
+  // us a reference which we release in destroy().
+  if (instance_object_.type == PP_VARTYPE_UNDEFINED)
+    instance_object_ = instance_->GetInstanceObject();
   // GetInstanceObject talked to the plugin which may have removed the instance
   // from the DOM, in which case instance_ would be NULL now.
   if (!instance_)
     return NULL;
 
+  scoped_refptr<NPObjectVar> object(NPObjectVar::FromPPVar(instance_object_));
   // If there's an InstanceObject, tell the Instance's MessageChannel to pass
   // any non-postMessage calls to it.
   if (object) {
     instance_->message_channel().SetPassthroughObject(object->np_object());
   }
   NPObject* message_channel_np_object(instance_->message_channel().np_object());
   // The object is expected to be retained before it is returned.
   WebKit::WebBindings::retainObject(message_channel_np_object);
   return message_channel_np_object;
 }
@@ skipping 140 matching lines @@
 bool WebPluginImpl::canRotateView() {
   return instance_->CanRotateView();
 }
 
 void WebPluginImpl::rotateView(RotationType type) {
   instance_->RotateView(type);
 }
 
 }  // namespace ppapi
 }  // namespace webkit